PT-2026-31854

CVE-2026-5998

Published

2026-04-10

Updated

2026-04-11

Description by

CVSS 4.0

5.5

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions zahayujie chatgpt-on-wechat CowAgent versions up to 2.0.4

Description A flaw exists in the function dispatch of the file agent/memory/service.py within the API Memory Content Endpoint component. Manipulation of the filename argument can lead to path traversal, allowing for remote exploitation. The exploit has been published.

Recommendations Upgrade to version 2.0.5 to resolve the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Yu_Bao

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers